Legal
Sub-processors, all of them.
Every third party that touches data on ADM's behalf, what it receives, and where it processes it.
Last updated 11 September 2026
Notice of changes. We tell customers before adding or replacing a sub-processor, as Art. 28(2) requires, and a customer may object on reasonable data protection grounds. This page is updated in the same release as the integration itself — never afterwards.
| Provider | What it does | What it receives | Where | Transfer basis |
|---|---|---|---|---|
| Twilio SendGrid | Email delivery, and the delivery/engagement events that come back | Recipient email address, email content, delivery and engagement events | United States | Standard Contractual Clauses |
| MongoDB Atlas | Primary database — every record the platform holds | All customer and contact data | EU (Ireland) | Within EEA |
| Vercel | Application hosting and scheduled processing | All data in transit; application logs | EU region, US company | Standard Contractual Clauses |
| DeepSeek | Generating email copy and qualifying leads | Recipient name, company, country, role, research summary, campaign brief | Outside EEA | Standard Contractual Clauses · contractually barred from training on our data |
| Cloudinary | Storing brochures, images and video used in campaigns | Customer-uploaded assets. No contact data. | EU / US | Standard Contractual Clauses |
| Meta Platforms (WhatsApp Cloud API) | WhatsApp campaign delivery, where a customer uses that channel | Recipient phone number, message content | United States | Standard Contractual Clauses |
| Serper | Web search during lead discovery | Search queries. No contact data is sent. | United States | Standard Contractual Clauses |
| Stripe | Subscription billing | Customer billing details. No contact data. | EU / US | Standard Contractual Clauses |
What none of them may do
- Use the data for their own purposes.
- Train models on it. This is contractual with our model providers, not assumed.
- Onward-transfer it except under equivalent terms.
- Retain it after our instruction to delete.
What we do not use
Worth stating, because their absence is a choice. The public website loads no analytics, no advertising pixels, no session recording, no chat widget and no social embeds — see the cookie page, which describes the deployed behaviour rather than an intention. We do not use data brokers to enrich contacts beyond the business fields listed in the sending policy, and we do not share contact data between customers under any circumstances.